## 修改 /etc/hosts 增加如下内容

172.16.249.101 elk-1
172.16.249.102 elk-2

# 安装 java 1.8

yum install -y epel-release
yum install -y java-1.8.0-openjdk.x86_64

# 关闭
    systemctl stop firewalld
    # 开启启动关闭
    systemctl disable firewalld

# create user elk

groupadd elk
useradd elk -g elk

mkdir  -pv  /data/elk/{data,logs}
chown -R elk:elk /data/elk/

更新两台服务器时间保持一致
yum install -y ntp
ntp.tuna.tsinghua.edu.cn

#!/usr/bin/env bash

# author: liuwenqi


# 初始化

# 关闭 selinux

Selinux_status=`/usr/sbin/sestatus | grep 'SELinux\ status' | awk '{print $3}'`

function if_selinux() {
  if [ "$Selinux_status" == "enabled" ]; then
     /usr/bin/sed -i '1,$s/SELINUX=enforcing/SELINUX=disabled/g'  /etc/selinux/config
  else
    echo "Selinux 已经关闭"
  fi
}
if_selinux

# 关闭防火墙
function Stop_firewalld() {
    # 关闭
    systemctl stop firewalld
    # 开启启动关闭
    systemctl disable firewalld
}

Stop_firewalld

# 安装 java 1.8

yum install -y epel-release
yum install -y java-1.8.0-openjdk.x86_64
# create user elk

groupadd elk
useradd elk -g elk


# 创建数据及日志文件并授权

mkdir  -pv  /data/elk/{data,logs}
chown -R elk:elk /data/elk/

# 判断
if [ $? != 0 ]; then
    echo " 上述命令执行失败！ "
    exit 1
else
    reboot
fi

   cd /opt/   # 解压到当前目录   tar -xf elasticsearch-7.2.0-linux-x86_64.tar.gz -C .

# 集群名
cluster.name: elk
# 节点名
node.name: node-1
# 存储数据
path.data: /data/elk/data
# 存放日志
path.logs: /data/elk/logs
# 锁内存，尽量不使用交换内存
bootstrap.memory_lock: false
# 网络地址
network.host: 0.0.0.0
http.port: 9200
# 发现集群hosts
discovery.seed_hosts: ["elk-1", "elk-2"]
# 设置集群master节点
cluster.initial_master_nodes: ["node-1"]

* soft nofile 65536
  * hard nofile 131072
  * soft nproc 2048
  * hard nproc 4096

nohup runuser -l elk -c '/bin/bash /opt/elasticsearch-7.2.0/bin/elasticsearch' &

ERROR: [4] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]
[2]: memory locking requested for elasticsearch process but memory is not locked
[3]: max number of threads [3818] for user [elk] is too low, increase to at least [4096]
[4]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

## 根据相应的报错信息进行修改

复制elsticsearch将其文件夹下的data文件夹一并复制了，/data/elk/data文件夹下已经产生了data历史数据，删除即可

curl  -XGET 'localhost:9200/_cluster/health?pretty'

`curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.2.0-x86_64.rpm`
`sudo rpm -vi filebeat-7.2.0-x86_64.rpm`

## 抓取日志文件操作
  filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /var/log/*.log  # 抓取文件路径

  ## 多文件添加可以在paths:后面增加
    paths:
      - /var/log/*.log
      - /var/log/nginx/access.log
output.elasticsearch:
  hosts: ["elk-1:9200"]   ## 输出到es
  # 多台es，更改为host: ["IP-1:9200","IP-2:9200"]

filebeat test config -e

# vim 修改 /etc/filebeat/filebeat.yml
# 在 #logging.level: debug 后面添加
logging.level: info # 日志级别 
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644

以nginx日志为例子
cd /etc/filebeat/filebeat/
修改 nginx.yml.disabled

- module: nginx
  # Access logs
  access:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths:
    ##增加下面这行
      - /var/log/nginx/access.log
    # Convert the timestamp to UTC. Requires Elasticsearch >= 6.1.
    #var.convert_timezone: true

  # Error logs
  error:
    enabled: true

mv nginx.yml.disabled nginx.yml

cd /opt/
tar -xf kibana-7.2.0-linux-x86_64.tar.gz -C .

cd /opt/kibana-7.2.0-linux-x86_64
vim ./config/kibana.yml

server.port: 5601  # port
server.host: 0.0.0.0 # 访问限制
elasticsearch.hosts: ["http://localhost:9200"] ## elasticsearch 访问地址
i18n.locale: "zh-CN" # 中文

# 由于kibana 已node方式启动
kill -9 `ps -ef | grep node| grep -v grep | awk '{print $2}'`